linux_dsm_epyc7002/drivers/infiniband/hw
Michael J. Ruhl a0e0cb8280 IB/hfi1: Eliminate races in the SDMA send error path
pq_update() can only be called in two places: from the completion
function when the complete (npkts) sequence of packets has been
submitted and processed, or from setup function if a subset of the
packets were submitted (i.e. the error path).

Currently both paths can call pq_update() if an error occurrs.  This
race will cause the n_req value to go negative, hanging file_close(),
or cause a crash by freeing the txlist more than once.

Several variables are used to determine SDMA send state.  Most of
these are unnecessary, and have code inspectible races between the
setup function and the completion function, in both the send path and
the error path.

The request 'status' value can be set by the setup or by the
completion function.  This is code inspectibly racy.  Since the status
is not needed in the completion code or by the caller it has been
removed.

The request 'done' value races between usage by the setup and the
completion function.  The completion function does not need this.
When the number of processed packets matches npkts, it is done.

The 'has_error' value races between usage of the setup and the
completion function.  This can cause incorrect error handling and leave
the n_req in an incorrect value (i.e. negative).

Simplify the code by removing all of the unneeded state checks and
variables.

Clean up iovs node when it is freed.

Eliminate race conditions in the error path:

If all packets are submitted, the completion handler will set the
completion status correctly (ok or aborted).

If all packets are not submitted, the caller must wait until the
submitted packets have completed, and then set the completion status.

These two change eliminate the race condition in the error path.

Reviewed-by: Mitko Haralanov <mitko.haralanov@intel.com>
Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2018-09-11 10:05:16 -06:00
..
bnxt_re Merge branch 'uverbs_dev_cleanups' into rdma.git for-next 2018-09-05 16:21:22 -06:00
cxgb3 RDMA/providers: Remove pointless functions 2018-07-30 20:31:54 -06:00
cxgb4 iw_cxgb4: only allow 1 flush on user qps 2018-09-04 15:07:56 -06:00
hfi1 IB/hfi1: Eliminate races in the SDMA send error path 2018-09-11 10:05:16 -06:00
hns RDMA/hns: Fix an error code in hns_roce_v2_init_eq_table() 2018-09-11 10:00:23 -06:00
i40iw RDMA/providers: Remove pointless functions 2018-07-30 20:31:54 -06:00
mlx4 Linux 4.18 2018-08-16 13:12:00 -06:00
mlx5 RDMA/mlx5: Allow creating a matcher for a NIC TX flow table 2018-09-11 09:28:07 -06:00
mthca RDMA/providers: Fix return value from create_srq callbacks 2018-07-30 20:29:45 -06:00
nes RDMA/nes: Delete impossible debug prints 2018-09-05 15:58:30 -06:00
ocrdma RDMA/providers: Remove pointless functions 2018-07-30 20:31:54 -06:00
qedr RDMA/qedr: remove set but not used variable 'ctx' 2018-09-05 15:55:22 -06:00
qib IB/{hfi1, qib, rdmavt}: Schedule multi RC/UC packets instead of posting 2018-09-11 09:55:02 -06:00
usnic infiniband: remove redundant condition check before debugfs_remove 2018-09-11 09:37:05 -06:00
vmw_pvrdma RDMA/providers: Remove pointless functions 2018-07-30 20:31:54 -06:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00